Yii Auth

The package provides various authentication methods, a set of abstractions to implement in your application, and a PSR-15 middleware to authenticate an identity.

Requirements

• PHP 8.1 - 8.5.

Installation

General usage

Configure a middleware and add it to your middleware stack:

In order to get an identity instance in the following middleware use getAttribute() method of the request instance:

HTTP basic authentication

Basic HTTP authentication is typically used for entering login and password in the browser. Credentials are passed as $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'].

Realm is typically what you will see in the browser prompt asking for a login and a password. Custom authentication callback set in the above is the same as default behavior when it is not specified.

HTTP bearer authentication

Bearer HTTP authentication is typically used in APIs. The authentication token is passed in the request's Authorization header. On failure, the failure handler adds a WWW-Authenticate response header.

Custom HTTP header authentication

Custom HTTP header could be used if you do not want to leverage bearer token authentication:

In the above we use full value of X-Api-Key header as token.

Query parameter authentication

This authentication method is mainly used by clients unable to send headers. In case you do not have such clients we advise not to use it.

HTTP cookie authentication

Typical authentication for websites by storing a token in a browser cookie.

Using multiple authentication methods

To use multiple authentication methods, use Yiisoft\Auth\Method\Composite:

Extension and integration points

• \Yiisoft\Auth\IdentityInterface should be implemented by your application identity class. Typically, that is User.
• \Yiisoft\Auth\IdentityRepositoryInterface should be implemented by your application identity repository class. Typically, that is UserIdentity.
• \Yiisoft\Auth\IdentityWithTokenRepositoryInterface could be additionally implemented by your application identity repository class in case token-based authentication is needed. Typically, that is UserIdentity.
• \Yiisoft\Auth\AuthenticatorInterface should be implemented to provide your own authenticator.
• \Yiisoft\Auth\AuthenticatorWithChallengeInterface could be implemented instead by an authenticator that also needs to modify the authentication failure response, for example, to add an HTTP authentication challenge.
• \Yiisoft\Auth\AuthenticationMethodInterface is equivalent to AuthenticatorWithChallengeInterface and is deprecated. Existing implementations remain compatible; new implementations should use the focused interfaces.

Documentation

• Internals

If you need help or have a question, the Yii Forum is a good place for that. You may also check out other Yii Community Resources.

License

The Yii Auth is free software. It is released under the terms of the BSD License. Please see LICENSE for more information.

Maintained by Yii Software.

Support the project

Follow updates